Broken Object Level Authorization (BOLA) — also known as IDOR — is the most common

serious API flaw and the root cause of many of the largest data leaks of the last

decade. This guide explains how it happens, why scanners miss it, how to test for it

with an identity matrix, and how to fix it structurally.

1. What BOLA actually is

BOLA (Broken Object Level Authorization) is OWASP API Security API1:2023 . The

older, web-era name is IDOR (Insecure Direct Object Reference). The idea is simple:

The API checks who you are , but not whether you are allowed to touch this specific

object .

A user authenticates correctly. The token is valid. The request is well-formed. The

only problem is that the object in the request belongs to someone else — and the API

returns it anyway.

GET / api / v1 / invoices / 1042 HTTP / 1.1 Host : api . example . com Authorization : Bearer eyJhbGciOiJIUzI1NiIs . .…